Is there a conflict between the ACCEPT and DROP rules in iptables for two ipset lists?

Question

iptables

There are two lists badips and goodips, and they have some of the same ip addresses. goodips is set to ACCEPT policy DROP, and badips is set to DROP policy ACCEPT. What will happen to the ip addresses that are in both lists, will they be blocked or allowed? All rules for incoming INPUT packets

Answer 1

There is no conflict. The result depends on the order in which you write the rules. If ACCEPT comes first, then ACCEPT will work and the rule where DROP will simply not reach. And vice versa, if DROP first, then it will work. This is a general principle for the filter table: the rules in the chain are iterated until one works. As soon as it worked, we no longer look at the rest in this chain.